#CVE

共收录 64179 条相关情报。

漏洞预警2026-10-23 发布INFO

Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent De...

CVE-2026-107858

Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) i

来源摘录 · NVD

#cve #cwe-1385 #cwe-306 #cwe-942

漏洞预警2026-10-23 发布INFO

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to...

CVE-2026-86055

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds

来源摘录 · NVD

#cve #cwe-640

漏洞预警2026-10-23 发布INFO

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum...

CVE-2026-86019

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-23 发布INFO

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum att...

CVE-2026-86018

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-23 发布MEDIUM

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled ...

CVE-2026-59188

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server

来源摘录 · NVD

#cve #cwe-434 #cwe-79

漏洞预警2026-10-23 发布MEDIUM

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfis

来源摘录 · NVD

#cve #cwe-1287

漏洞预警2026-10-23 发布MEDIUM

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific mainte...

CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/node

来源摘录 · NVD

#cve #cwe-424

漏洞预警2026-10-23 发布INFO

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw f...

CVE-2026-55600

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB render

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-23 发布MEDIUM

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed valu...

CVE-2026-54631

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-23 发布CRITICAL

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-...

CVE-2026-54630

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attac

来源摘录 · NVD

#cve #cwe-434

漏洞预警2026-10-23 发布MEDIUM

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of unco

来源摘录 · NVD

#cve #cwe-409

漏洞预警2026-10-23 发布INFO

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access se...

CVE-2026-19678

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase For

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-23 发布INFO

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary ...

CVE-2026-19677

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthe

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-23 发布MEDIUM

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file app...

CVE-2026-115536

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Th

来源摘录 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-23 发布LOW

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the f...

CVE-2026-115535

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The aff

来源摘录 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-23 发布HIGH

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet ...

CVE-2026-115486

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer addres

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-23 发布MEDIUM

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to...

CVE-2026-115485

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data wi

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-23 发布HIGH

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated...

CVE-2026-115484

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-22 发布HIGH

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the ...

CVE-2026-92450

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HM

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-22 发布LOW

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where ...

CVE-2026-115449

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data

来源摘录 · NVD

#cve #cwe-200